Subnets without site associations count should be retrievable
AD-SUB-11InfoActive DirectorySites and subnets
Part of Active Directory · Active Directory · Sites and subnets · All checks
Invoke-Maester -TestId AD-SUB-11Overview
Section titled “Overview”Subnets without site associations (orphaned subnets) can cause:
- Client mislocation: Computers with these IPs cannot determine their site
- Authentication inefficiency: Clients may authenticate to distant DCs
- Configuration drift: Orphaned subnets may indicate incomplete cleanup
- Operational confusion: Unclear which locations these subnets serve
Orphaned subnets should be either assigned to sites or removed.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Assign orphaned subnets to appropriate sites
- Remove subnets that are no longer in use
- Review subnet assignments during network changes
- Document the purpose and location of all subnets
How the Test Works
Section titled “How the Test Works”This test identifies subnets that have no site association (SiteObject is null).
Related Tests
Section titled “Related Tests”Test-MtAdSiteWithoutSubnetCount- Identifies sites without subnetsTest-MtAdSubnetSiteAssociationCount- Counts sites with subnetsTest-MtAdSubnetTotalCount- Counts total subnets
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-SUB-11 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Sites and subnets |
| Area | Infrastructure hardening |
| Resource type | AdSite |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdSubnetWithoutSiteCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:subnet:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/site/Test.AD-SUB-11.ps1 - Documentation:
tests/ad/site/Test.AD-SUB-11.md